Authentication documentation in Rest API - Step-by-Step Execution

Concept Flow - Authentication documentation

Client sends credentials

↓

Server verifies credentials

↓

Issue token

↓

Client uses token for requests

↓

Server validates token on each request

The client sends credentials to the server, which checks them. If valid, the server issues a token. The client uses this token for future requests, and the server validates it each time.

Execution Sample

Rest API

POST /login
Body: {"user":"alice", "pass":"1234"}
Response: {"token":"abc123"}

GET /data
Header: Authorization: Bearer abc123
Response: {"data": "secret"}

Client logs in with username and password, receives a token, then uses that token in the Authorization header to access protected data.

Execution Table

Step	Action	Input	Server Response	Client State
1	Send login request	{"user":"alice", "pass":"1234"}	200 OK, {"token":"abc123"}	Has token abc123
2	Send data request with token	Header: Authorization: Bearer abc123	200 OK, {"data": "secret"}	Token used for access
3	Send data request with invalid token	Header: Authorization: Bearer wrongtoken	401 Unauthorized	Access denied
4	Send data request without token	No Authorization header	401 Unauthorized	Access denied

💡 Requests stop when client has valid token or is denied access due to invalid/missing token.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
token	null	abc123	abc123	abc123	abc123
access_granted	false	true	true	false	false

Key Moments - 2 Insights

Why does the server reject requests without a token or with a wrong token?

The server checks the Authorization header for a valid token. If missing or invalid (see execution_table rows 3 and 4), it returns 401 Unauthorized to protect data.

How does the client use the token after login?

After receiving the token in step 1, the client includes it in the Authorization header for future requests (step 2), allowing access to protected resources.

Visual Quiz - 3 Questions

Look at the execution table, what is the server response when the client sends a valid token?

A 401 Unauthorized

B 500 Internal Server Error

C 200 OK with data

D Redirect to login

💡 Hint

Check execution_table row 2 under 'Server Response'

At which step does the client receive the token?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at execution_table row 1, server response includes the token

If the client sends no Authorization header, what happens according to the execution table?

A Access granted

B Server returns 401 Unauthorized

C Server returns 200 OK

D Server ignores the request

💡 Hint

See execution_table row 4, server response is 401 Unauthorized

Concept Snapshot

Authentication in REST API:
- Client sends credentials (e.g., username/password) to /login
- Server verifies and returns a token if valid
- Client includes token in Authorization header for protected requests
- Server validates token on each request
- Invalid or missing token causes 401 Unauthorized response

Full Transcript

Authentication in REST APIs works by the client sending login credentials to the server. The server checks these credentials and if they are correct, it sends back a token. The client then uses this token in the Authorization header for future requests to access protected data. The server checks the token each time and only allows access if the token is valid. If the token is missing or wrong, the server responds with 401 Unauthorized to keep data safe.